thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Stored Cross-Site Scripting

XSS in which a malicious script is saved by the application and later served to other users.

Definition

Also called persistent XSS, it commonly appears in comments, profiles and support tickets and can affect many users, including administrators. Defenses are output encoding on display, rich-text sanitization with a vetted library, CSP and HttpOnly cookies.

Example

A forum signature containing script runs in every visitor's browser who views the thread.

Exam tip

Stored XSS is generally more severe because it needs no crafted link and hits every viewer.

Related terms